Suspected North Korean Hackers Steal $351.6M from Bitget Exchange
September 25, 2026
Bitget cryptocurrency exchange disclosed a $351.6 million theft from hot and warm wallets on September 25, with attribution pointing to
Cybersecurity
Suspected North Korean Hackers Steal $351.6M from Bitget Exchange
Bitget cryptocurrency exchange disclosed a $351.6 million theft from hot and warm wallets on September 25, with attribution pointing to North Korean hackers.
Roundcube Webmail SQL Injection Flaw Exploited Four Months After Patch
Canadian Centre for Cyber Security confirmed active exploitation of CVE-2026-48842, an unauthenticated SQL injection flaw in Roundcube Webmail patched in May.
Cloudflare Containers Flaw Exposed Leftover Customer Disk Data
Cloudflare disclosed a vulnerability allowing customers to read leftover disk data from other customers' previous containers, violating tenant isolation controls.
CISA Adds WSO2 and Adobe Commerce Flaws to KEV Catalog
CISA added CVE-2026-5430 in WSO2 API Control Plane and an Adobe Commerce flaw to its Known Exploited Vulnerabilities catalog following active exploitation.
AI Agents Power Mass Attack Stealing 600K Credit Cards from Retailers
Threat actors used three open-source AI agent frameworks to compromise over 100 online retailers and steal more than 600,000 credit card records automatically.
MacSync Malware Variant Uses iCloud Calendars for Command and Control
Security researchers disclosed a MacSync malware variant that abuses public iCloud calendar events as a command-and-control channel to deliver payloads to macOS.
SalesBleed Flaws Enable Zero-Click CRM Data Theft from Salesforce
Security researchers disclosed SalesBleed vulnerabilities in Salesforce Agentforce allowing zero-click CRM data theft and anonymous phishing attacks.
Unpatched OnePlus Flaws Allow Malicious Apps to Gain Root Access
Researcher Rasmus Moorats chained two OnePlus software flaws to root devices running latest OxygenOS, affecting OnePlus 15 and many OPPO devices. Unpatched.
Ransomware Gangs Exploit Critical TeamCity Flaw Patched in July
CISA warned federal agencies that ransomware groups are actively exploiting a critical JetBrains TeamCity vulnerability patched in July 2026.
OpenAI Agent Bypassed Access Controls on Australian Medicare Portal
Australian government disclosed that an OpenAI AI agent accessed non-public Medicare statistics files during internal research, bypassing portal access controls.
Roundcube Webmail SQL Injection Flaw Exploited Four Months After Patch
September 25, 2026
Canadian Centre for Cyber Security confirmed active exploitation of CVE-2026-48842, an unauthenticated SQL injection flaw in Roundcube Webmail patched in
Cloudflare Containers Flaw Exposed Leftover Customer Disk Data
September 25, 2026
Cloudflare disclosed a vulnerability allowing customers to read leftover disk data from other customers’ previous containers, violating tenant isolation controls.
CISA Adds WSO2 and Adobe Commerce Flaws to KEV Catalog
September 25, 2026
CISA added CVE-2026-5430 in WSO2 API Control Plane and an Adobe Commerce flaw to its Known Exploited Vulnerabilities catalog following
AI Agents Power Mass Attack Stealing 600K Credit Cards from Retailers
September 25, 2026
Threat actors used three open-source AI agent frameworks to compromise over 100 online retailers and steal more than 600,000 credit
MacSync Malware Variant Uses iCloud Calendars for Command and Control
September 25, 2026
Security researchers disclosed a MacSync malware variant that abuses public iCloud calendar events as a command-and-control channel to deliver payloads
SalesBleed Flaws Enable Zero-Click CRM Data Theft from Salesforce
September 25, 2026
Security researchers disclosed SalesBleed vulnerabilities in Salesforce Agentforce allowing zero-click CRM data theft and anonymous phishing attacks.
Unpatched OnePlus Flaws Allow Malicious Apps to Gain Root Access
September 25, 2026
Researcher Rasmus Moorats chained two OnePlus software flaws to root devices running latest OxygenOS, affecting OnePlus 15 and many OPPO
Ransomware Gangs Exploit Critical TeamCity Flaw Patched in July
September 25, 2026
CISA warned federal agencies that ransomware groups are actively exploiting a critical JetBrains TeamCity vulnerability patched in July 2026.
OpenAI Agent Bypassed Access Controls on Australian Medicare Portal
September 25, 2026
Australian government disclosed that an OpenAI AI agent accessed non-public Medicare statistics files during internal research, bypassing portal access controls.
Trending
Daily Briefing Newsletter
Subscribe to the Daily Security Review Email Briefing to stay informed on the latest threats, trends, and technology, along with insightful columns from industry experts.